chore: import upstream snapshot with attribution

scripts/ci/check-glibc-compat.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+# Regression guard: the linux binary we ship must START on OLD glibc.
+#
+# The standard linux release binary dynamically links glibc 2.38+ / GLIBCXX
+# 3.4.32 and fails to start on Debian 11, RHEL/Rocky 8, Ubuntu 20.04, Amazon
+# Linux 2, etc. The fix points all linux install + self-update paths at the
+# fully-static "-portable" asset. This runs a given linux binary inside an
+# old-glibc container (debian:bullseye, glibc 2.31) and asserts it starts:
+#   - RED  for the dynamic standard binary  (GLIBC_2.38 not found)
+#   - GREEN for the static -portable binary (runs anywhere)
+#
+# Usage: check-glibc-compat.sh <path-to-linux-binary>
+# Env:   GLIBC_TEST_IMAGE  (default: debian:bullseye-slim, glibc 2.31)
+set -euo pipefail
+
+BIN="${1:?usage: check-glibc-compat.sh <path-to-linux-binary>}"
+IMAGE="${GLIBC_TEST_IMAGE:-debian:bullseye-slim}"
+BIN_ABS="$(cd "$(dirname "$BIN")" && pwd)/$(basename "$BIN")"
+
+echo "==> running $(basename "$BIN") --version inside ${IMAGE} (glibc 2.31)"
+docker run --rm -v "${BIN_ABS}:/cbm:ro" "${IMAGE}" /cbm --version
+echo "PASS: binary starts on old glibc (${IMAGE})"

scripts/ci/check-virustotal.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+# Wait for VirusTotal scans to complete and check results.
+# Expects: VT_API_KEY, VT_ANALYSIS (comma-separated "file=URL" pairs)
+set -euo pipefail
+
+MIN_ENGINES=60
+rm -f /tmp/vt_gate_fail
+
+echo "=== Waiting for VirusTotal scans to fully complete ==="
+
+echo "$VT_ANALYSIS" | tr ',' '\n' | while IFS= read -r entry; do
+  [ -z "$entry" ] && continue
+  FILE=$(echo "$entry" | cut -d'=' -f1)
+  URL=$(echo "$entry" | cut -d'=' -f2-)
+  BASENAME=$(basename "$FILE")
+
+  # Extract base64 analysis ID from URL
+  ANALYSIS_ID=$(echo "$URL" | sed -n 's|.*/file-analysis/\([^/]*\)/.*|\1|p')
+  if [ -z "$ANALYSIS_ID" ]; then
+    ANALYSIS_ID=$(echo "$URL" | grep -oE '[a-f0-9]{64}')
+    if [ -z "$ANALYSIS_ID" ]; then
+      echo "BLOCKED: Cannot parse VirusTotal URL: $URL"
+      echo "FAIL" >> /tmp/vt_gate_fail
+      continue
+    fi
+  fi
+
+  # Poll until completed (max 120 min)
+  SCAN_COMPLETE=false
+  for attempt in $(seq 1 720); do
+    RESULT=$(curl -sf --max-time 10 \
+      -H "x-apikey: $VT_API_KEY" \
+      "https://www.virustotal.com/api/v3/analyses/$ANALYSIS_ID" 2>/dev/null || echo "")
+
+    if [ -z "$RESULT" ]; then
+      echo "  $BASENAME: waiting (attempt $attempt)..."
+      sleep 10
+      continue
+    fi
+
+    STATS=$(echo "$RESULT" | python3 -c "
+import json, sys
+d = json.loads(sys.stdin.read())
+attrs = d.get('data', {}).get('attributes', {})
+status = attrs.get('status', 'queued')
+stats = attrs.get('stats', {})
+malicious = stats.get('malicious', 0)
+suspicious = stats.get('suspicious', 0)
+undetected = stats.get('undetected', 0)
+harmless = stats.get('harmless', 0)
+total = sum(stats.values())
+completed = malicious + suspicious + undetected + harmless
+print(f'{status},{malicious},{suspicious},{completed},{total}')
+" 2>/dev/null || echo "queued,0,0,0,0")
+
+    STATUS=$(echo "$STATS" | cut -d',' -f1)
+    MALICIOUS=$(echo "$STATS" | cut -d',' -f2)
+    SUSPICIOUS=$(echo "$STATS" | cut -d',' -f3)
+    COMPLETED=$(echo "$STATS" | cut -d',' -f4)
+    TOTAL=$(echo "$STATS" | cut -d',' -f5)
+
+    if [ "$STATUS" = "completed" ]; then
+      SCAN_COMPLETE=true
+      if [ "$COMPLETED" -lt "$MIN_ENGINES" ]; then
+        echo "NOTE: $BASENAME completed with only $COMPLETED/$TOTAL engines (< $MIN_ENGINES)"
+      fi
+      if [ "$MALICIOUS" -gt 0 ] || [ "$SUSPICIOUS" -gt 0 ]; then
+        echo "BLOCKED: $BASENAME flagged ($MALICIOUS malicious, $SUSPICIOUS suspicious / $COMPLETED engines)"
+        echo "  $URL"
+        echo "FAIL" >> /tmp/vt_gate_fail
+      else
+        echo "OK: $BASENAME clean ($COMPLETED engines, 0 detections)"
+      fi
+      break
+    fi
+
+    echo "  $BASENAME: $COMPLETED/$TOTAL engines ($STATUS, attempt $attempt)..."
+    sleep 10
+  done
+
+  if [ "$SCAN_COMPLETE" != "true" ]; then
+    echo "WARNING: $BASENAME scan did not complete in time"
+    echo "FAIL" >> /tmp/vt_gate_fail
+  fi
+done
+
+if [ -f /tmp/vt_gate_fail ]; then
+  echo "BLOCKED: One or more VirusTotal checks failed"
+  exit 1
+fi
+echo "=== All VirusTotal scans passed ==="